Cybersecurity: What Are the Threats and New Insurance Requirements

By: Tim Lyons, CPA and Jon Hightower, CCSFP, CHQP, CISA, CRISC, CIPT, and FAIR

In today’s digitally-driven world, cybersecurity has become a paramount concern, especially for state and local governments. As your trusted CPA firm, we want to keep you informed about the increasing risks and provide insights on how to mitigate these threats. Here is an overview of the cybersecurity challenges faced by state and local governments and steps you can take to protect your organization.

The Growing Cybersecurity Threat

Cybersecurity threats continue to evolve, posing significant risks to organizations of all sizes. Protecting sensitive data and maintaining secure systems is more critical than ever. Below are some of the most common cybersecurity threats organizations face:

• Ransomware Attacks: Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid. State and local governments are prime targets for these attacks due to their vast amounts of sensitive data and often outdated security measures. Recent incidents have shown how disruptive these attacks can be, leading to significant financial losses and operational downtimes.
• Data Breaches: Governments hold a treasure trove of sensitive information, from personal identification details to financial records. Cybercriminals often target this data, leading to breaches that can have far-reaching consequences, including identity theft and financial fraud.
• Phishing and Social Engineering: Phishing attacks and social engineering schemes exploit human psychology to gain unauthorized access to systems. These attacks often come in the form of deceptive emails or messages, tricking employees into revealing confidential information, or installing malicious software.
• Insider Threats: Not all threats come from outside. Insider threats, whether intentional or accidental, pose significant risks. Employees with access to sensitive data can unintentionally cause breaches through careless actions or, in some cases, may act maliciously.

Mitigation Strategies

To effectively safeguard against cybersecurity threats, organizations must implement robust strategies to mitigate potential risks. By adopting proactive measures, entities can reduce vulnerabilities and enhance their overall security posture. Key mitigation strategies include:

• Employee Training and Awareness: Investing in regular cybersecurity training for employees is crucial. Awareness programs can help staff recognize phishing attempts and understand the importance of data protection protocols.
• Implementing Robust Security Measures: Ensure that your systems are equipped with up-to-date security software, including firewalls, anti-virus programs, and intrusion detection systems. Regular updates and patches are essential to protect against new vulnerabilities.
• Data Encryption: Encrypting sensitive data can prevent unauthorized access, even if the data is intercepted. This adds an extra layer of security, making it difficult for cybercriminals to exploit stolen information.
• Regular Backups: Maintain regular backups of all critical data. In the event of a ransomware attack or other data loss incident, having backups can enable a swift recovery without paying a ransom.
• Incident Response Plan: Develop and regularly update an incident response plan. This plan should outline steps to take in the event of a cyberattack, including communication strategies, containment procedures, and recovery processes.

New Insurance Requirements
Many insurance carriers are increasingly requiring organizations to undergo cybersecurity audits or assessments as a condition for obtaining cyber insurance. This trend reflects the growing concern among insurers about the rising frequency and severity of cyberattacks, such as ransomware, data breaches, and other cyber incidents. Some reasons why insurers require cybersecurity audits:

• Risk Evaluation and Pricing: Insurers use cybersecurity audits to evaluate an organization’s risk profile. This assessment helps insurers determine the likelihood of a cyber incident occurring and the potential cost of a claim. The results of the audit can impact the insurance premium, coverage limits, and the types of risks that the policy will cover.
• Verification of Cybersecurity Practices: Cybersecurity audits allow insurers to verify that an organization is adhering to best practices in cybersecurity, such as implementing multi-factor authentication (MFA), maintaining up-to-date software and patches, conducting employee training, and having incident response plans in place. Insurers want to ensure that policyholders have a minimum level of cybersecurity hygiene to mitigate the risk of an attack.
• Reduction of Claims: By requiring audits, insurers aim to reduce the number of claims by ensuring that organizations are better protected against cyber threats. Organizations with stronger cybersecurity practices are less likely to experience a breach or other cyber incident, which ultimately reduces the insurer’s liability.
• Compliance with Underwriting Criteria: Insurers often have specific underwriting criteria that must be met to issue a policy. A cybersecurity audit helps ensure that the applicant meets these criteria. If gaps or vulnerabilities are found during the audit, the insurer may require the organization to address them before granting coverage or may exclude certain risks from the policy.

There are many types of cybersecurity assessments that may be required including:

• Questionnaires and Self-Assessments: Many insurers start with a cybersecurity questionnaire or self-assessment that asks about the organization’s security policies, technologies, and practices. This information helps determine whether a more in-depth audit is necessary.
• Third-Party Cybersecurity Audits: Some insurers require a third-party cybersecurity audit or assessment, performed by a specialized firm, to evaluate the organization’s overall security posture. These audits can include penetration testing, vulnerability assessments, and reviews of security controls.
• Internal Audits with Documentation: Insurers may also accept internal audits, provided that the organization can demonstrate that the audit was conducted in line with recognized standards (such as NIST, ISO 27001, or CIS Controls) and provide detailed documentation.

The Role of Audits and Reviews
M&J offers comprehensive cybersecurity assessments, including penetration testing, social engineering evaluations, and security control audits.  These services are designed to identify vulnerabilities, assess the effectiveness of your current security measures, and recommend actionable improvements. While third-party partnerships may help mitigate some risks, the ultimate responsibility for protecting your data remains with your organization.  By proactively addressing potential weaknesses, you can significantly reduce the likelihood of cyber incidents and safeguard your critical information.

Conclusion
Cybersecurity is an ongoing concern that requires constant vigilance and proactive measures. State and local governments must prioritize cybersecurity to safeguard sensitive data and ensure the continued delivery of essential services. By staying informed and implementing robust security practices, we can collectively build a more secure digital environment.

If you have any questions or need assistance with cybersecurity audits or related services, please do not hesitate to contact us. We are here to help you navigate these challenges and protect your organization